[PATCH] ima: defer arch_ima_get_secureboot() call to IMA init time

[Ard Biesheuvel]

On Mon, 12 Oct 2020 at 23:29, Mimi Zohar <zohar at linux.ibm.com> wrote:
>
> Hi Ard,
>
> On Mon, 2020-10-12 at 10:36 +0200, Ard Biesheuvel wrote:
> > Chester reports that it is necessary to introduce a new way to pass
> > the EFI secure boot status between the EFI stub and the core kernel
> > on ARM systems. The usual way of obtaining this information is by
> > checking the SecureBoot and SetupMode EFI variables, but this can
> > only be done after the EFI variable workqueue is created, which
> > occurs in a subsys_initcall(), whereas arch_ima_get_secureboot()
> > is called much earlier by the IMA framework.
> >
> > However, the IMA framework itself is started as a late_initcall,
> > and the only reason the call to arch_ima_get_secureboot() occurs
> > so early is because it happens in the context of a __setup()
> > callback that parses the ima_appraise= command line parameter.
> >
> > So let's refactor this code a little bit, by using a core_param()
> > callback to capture the command line argument, and deferring any
> > reasoning based on its contents to the IMA init routine.
>
> Other than this patch needing to be on top of commit e4d7e2df3a09
> ("ima: limit secure boot feedback scope for appraise"), it looks good.
>

Thanks Mimi, I will rebase and resend.